OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 3rd quarter (Jul-Sep) 1998: Re: Fwd: Any user can panic OpenBSD machine

Re: Fwd: Any user can panic OpenBSD machine

Dag-Erling Coidan =?iso-8859-1?Q?Sm=F8rgrav?= (dag-erliIFI.UIO.NO)
Mon, 27 Jul 1998 23:08:40 +0200 

"Todd C. Miller" <Todd.Millercourtesan.com> writes:
> In message <xzphg0357ze.fsfhrotti.ifi.uio.no>
>       so spake  (dag-erli):
>
> > /sys/kern/sys_generic.c:
> >                 if (uap->iovcnt > UIO_MAXIOV)
> >                         return (EINVAL);
>
> We are talking about uio_resid not uio_iovcnt.

*thwap* my mistake. The relevant piece of code is:

/sys/kern/sys_generic.c:
        auio.uio_resid = 0;
        for (i = 0; i < uap->iovcnt; i++) {
                auio.uio_resid += iov->iov_len;
                if (auio.uio_resid < 0) {
                        error = EINVAL;
                        goto done;
                }
                iov++;
        }

and since, as someone pointed out, iov->iov_len is a size_t, it
doesn't make sense to check for negative values of auio.uio_resid. The
problem arises from auio.uio_resid being an int rather than a size_t.

DES (open mouth, insert foot, echo internationally)
--
Dag-Erling Smørgrav - dag-erliifi.uio.no